DE602004004029T2 - Method for distributing conference keys, according to an identity-based encryption system - Google Patents

Description

The The present invention relates to a data transmission method, and more particularly a method for distributing a conference key (session key), the common is used to transfer data between a plurality of parties encrypt.

There Computers are heavily developed, networks that use the computers connect, in importance and benefit too. Recently, however, have abuse increased by computers and networks. Therefore, there is a need to implement network security techniques.

One Protocol for the sharing of keys between participants (Inter-party Key Sharing Protocol) is a protocol that is used to preserve the secrecy of data transmitted through the networks. A standard protocol is the Diffie-Hellman protocol, which is on the difficulty is a problem of discrete logarithms using elliptic curve cryptography to solve. The Diffie-Hellman protocol is based on encryption with public Key Infrastructure (PKI, Public Key Infrastructure). However, PKI encryption has shortcomings in that it necessarily involves the involvement of a trusted authentication center includes, as integrity a public key must be guaranteed by the authentication center.

Because of the shortcomings the PKI encryption Much research has been done on a ID-based key usage protocol that does not rely on PKI encryption. Unfortunately conventional Key usage logs ID-based problems in being vulnerable to hidden attacks and provide no forward secrecy can.

EP 739105 describes methods for signature and key generation. In one embodiment, each subscriber pair generates a pair of random numbers. A conference key is determined from a random number of each of the participant pairs. In another embodiment, a key exchange protocol is described.

Xu and Tilborg, ISIT Sorrento 2000, June 2000, page 269 "a new identity-based conference key distribution scheme ". Each user generates a random number. A user initiated the exchange, sends a message to other users and receives answers. One user calculates a conference key and uses it for encryption the user ID. It will send a message to all other users sent the conference key calculate and use it to check the ID.

According to one Aspect of the present invention is a method of distribution a common conference key to encrypt a conference trigger party to a majority of conference participant parties in a single conference session on an ID-based cryptographic system according to claim 1 to disposal posed.

According to one Aspect of the present invention is a method of distribution a common conference key to encrypt a conference trigger party to a majority of conference participant parties in a single conference session on an ID-based cryptographic system according to claim 6 to disposal posed. According to one Another aspect of the present invention is a method for Distribute a common conference key to encrypt a conference trigger party to conference participant parties in a single conference session on an ID-based cryptographic system according to claim 11 to disposal posed.

According to one Another aspect of the present invention is a method for Distribute a common conference key to encrypt a conference trigger party to conference participant parties in a single conference session on an ID-based cryptographic system according to claim 15 to disposal posed.

The The present invention provides a method for distributing a Conference session key to disposal, that is able to withstand a hidden attack and to provide continued secrecy.

The The present invention also provides a computer readable storage medium available, that contains a program with a method for distributing a conference key on running a computer becomes.

The Above and other features and advantages of the present invention can be better seen from a detailed description of exemplary embodiments with reference to the accompanying drawings, in which:

1 Figure 3 is a conceptual diagram illustrating a cryptographic system using a problem of discrete logarithms in a finite field; and

2 A flowchart is the steps of a method of distributing a conference session key according to the present invention represents.

The present invention and its functional advantages are achieved by Reference to the accompanying drawings and the explanations understandable.

Now discloses a method of distributing a conference session key according to the present invention Invention with reference to the accompanying drawings described in detail.

1 FIG. 11 is a conceptual diagram illustrating a cryptographic system using a problem of discrete logarithms in a finite field. FIG.

The Cryptographic system according to the present Invention relies on the difficulty of having a problem of discrete logarithms in an elliptic curve cryptography group. The discrete logarithm in the elliptic curve cryptography group is a logarithm, the an elliptic curve addition group used in a finite Field is defined, that is, the definition domain. It is known that there is a problem in the discrete logarithm function is difficult to solve in the finite field instead of the real number field because the estimate using a simple size comparison is not available. In the present invention, the encryption of data is under use the difficulty in solving of the discrete logarithm problem.

In the cryptographic system using the discrete logarithm problem in the finite field, parties involved in data encryption use two variables p and g together. The variable p is a sufficiently large prime, which is determined depending on the security of the cryptographic system. The variable g is a basis for the multiplication group of the finite field, which has a divisor q in the order of p-1. Two parties A and B choose their own secret keys x _a and x _b , integers between 1 and q-1. The parties compute their own public keys y _a and y _b using their own secret keys, as shown in equations 1 and 2 below.

[Equation 1]

• y a = g xa mod p

[Equation 2]

• y b = g xb mod p

The both parties A and B exchange the public keys, and use a common key K in common, which comes from the public keys the counterparties and their own secret keys using the following Equation 3 are determined.

[Equation 3]

• K = g xaxb mod p

Party A calculates the common key K using its own secret key x _a and party B public key x _b , as shown in Equation 4 below. Party B calculates the common key K using its own secret key x _b and party A public key x _a , as shown in Equation 5 below.

[Equation 4]

• K = y b xa  = (g xb ) xa  = g xaxb  mod p

[Equation 5]

• K = y a xb  = (g xa ) xb  = g xaxb  mod p

Even though every attacker knows the public key, he needs the discrete logarithm problem in the cryptographic system to solve. That's why the secret key is the user does not disclose.

In the Diffie-Hellman method, basically the in 1 When used in a practical application, each user must temporarily create their own secret keys and public keys at each communication process.

urine and Yang have proposed a cryptographic system to the insufficiency when sharing a temporary key with each communication session using identification (ID) information. The System is referred to as an ID-based cryptography system.

In addition, Xu and Tilborg have proposed a multi-party key sharing protocol using the Harn and Yang method. The multiparty key usage protocol is a protocol that implements shared key usage at more than three parties and includes a key distribution protocol and a key agreement protocol. The key distribution protocol is a protocol in which a A key is generated by the conference trigger party and the key is securely distributed to the other parties as a shared key. The key agreement protocol is a protocol in which a common key is processed jointly for all participating parties to be used as a common session key.

The Xu and Tilborg's method is a key distribution protocol that an ID-based cryptography system implementation step and a Key usage log step includes. The ID-based cryptographic system uses the method of urine and yang.

The At each conference session, participating parties become one Conference Calling Party A and conference participant parties B and C are classified.

In the implementation step of the ID-based cryptographic system, a Key Authentication Center (KAC) provides its own public key y. The parties i (i = A, B, C) participating in the session know public key parameters G, p, α, y and f. The parameter G is a finite field multiplication group GF (P) * comprising integers of modulo p. The parameter p is a sufficiently large prime number. The "modulo p" is an operator whose result is a remainder of the division of p. The group G has the parameter α as a basis. The parameter f is a hash function. Each party i has a secret s _i and a public key r _i provided by the KAC.

The Steps of the key usage protocol Xu and Tilborg are as follows.

Step 1). The party A chooses an integer v ₁ , which is prime like p-1, between the integers 1 and p-1.

Step 2). The party A generates temporary public keys w ₁ and η ₁ , which are respectively shown in the following equations 6 and 7.

[Equation 6]

• w 1 = y v1 (mod p)

[Equation 7]

• η 1  = (f (ID 1 , time) - v 1 w 1 ) s 1 -1  (mod p-1)

In Equation 7, ID ₁ denotes information about Party A, and time denotes time information at the time of generation of Equation 7.

Step 3). Party A generates a message (ID ₁ , r ₁ , w ₁ , η ₁ , time) and transports the message to the parties B and C of the session.

Step 4). The participant parties B and C of the session receive the message (ID ₁ , r ₁ , w ₁ , η ₁ , time) and determine that the message satisfies the following equation 8.

[Equation 8]

• y f (ID1, time)  = w 1 w1  (α eid1 r 1 -r 1 ) η1  (mod p)

In Equation 8, EID ₁ = f (ID ₁ ).

If the notification of a permissible conference triggering party is sent, fulfilled they are the equation 8. Therefore, the validity of the party A sent message using the equation 8 completely determined become. In the case where Equation 8 is satisfied, the protocol goes to next Step over. Otherwise, the log is terminated.

Step 5). The participant parties B and C of the session respectively select integers V _B and V _C which, like p-1, are prime numbers between the integers 1 and p-1.

Step 6). The participant parties B and C of the session generate their own parameters w _j , n _j and η _j using the selected integer v _j (j = B, C) as shown in the following equations 9-11.

[Equation 9]

• w j = y vj (mod p)

[Equation 10]

• η j  = w j vj  (mod p)

[Equation 11]

• η j  = (n j  - v j w j ) s j -1  (mod p-1)

Step 7). The participating parties B and C generate their own messages of the session (ID _j, r _j, w _j, n _j, η _j) and transport the messages to the session initiating party A.

step 8th). The conference trigger party A determines that the contributions satisfy the following equation 12, below Use of the variables provided by participant parties B and C were received.

[Equation 12]

• y nj = w j wj  (α EIDj r j -RJ ) ηj  (mod p)

In Equation 12, EID _j = f (ID _j ).

If the message from an admissible conference participant party is sent, fulfilled them the equation 12. If the message from an invalid conference affiliate party is sent, it fulfills equation 12 is not. Therefore, the validity of the conference participants parties B and C sent using Equation 12 Completely be determined. In the case where equation 12 is satisfied, the log goes to the next one Step over. Otherwise, the log is terminated.

Step 9). The conference trigger party A selects an integer r between 1 and p-1 and generates a common key K _c and a variable z _j represented by the following equations 13 and 14, respectively.

[Equation 13]

• K c = y r (mod p) [Equation 14]
  
• Step 10). The conference initiation party A generates E _KC (ID ₁ ) by encrypting its own ID information ID ₁ with the common key K _c . Here, the symbol E denotes an encryption algorithm.

Step 11). The conference initiation party A transports a message (z ,, E _KC (ID ₁ )) to the parties that sent the messages that satisfy Equation 12.

Step 12). The party j calculates an inverse element v _j ^-1 of the integer v _j in the modulo p-1 and the common key K _c using the inverse element v _j ^-1 as shown in the following equation 15. (Equation 15)

E _KC (ID ₁ ) is encrypted with the common key K _{c obtained} from Equation 15, and it is determined that ID _{1 is} valid. If ID _{1 is} valid, the encryption protocol is continued using the common key K _c . If not, the log is terminated.

Unfortunately may be the multiparty key usage protocol executed by the aforementioned steps Xu and Tilborg have no features to prevent a hidden Attack and warranty have continued security for a multiparty key usage protocol are of importance.

The hidden attack is performed by an attacker who uses ID information of a party participating in the conference to intervene in the protocol. In this case, it is necessary to detect and prevent the hidden attack. However, the Xu and Tilborg Protocol can not detect the hidden attack. This is because the following Equation 16 with the parameters w _j and n _j v _j is met with the same variable, as shown in Equations 9 and 10. FIG.

[Equation 16]

• n j  = w j vj

The attacker generates a common key K _c 'and a variable z _j ' represented by the following equations 17 and 18, respectively, encrypted in step 9 ID information ID ₁ using the common key K _c 'and the variable z _j ' and conveys a message (z _j ', E _KC ' (ID ₁ )) to the conferees.

[Equation 17]

• K c '= y r ' (mod p)

[Equation 18]

• z j '= w j r ' (mod p)

The participants in the conference conduct the protocol, mistaking the communication for a valid communication. This is because the common key K _c 'is calculated using the following equation 19, and the ID information ID _{1 is} obtained by encrypting E _KC' (ID ₁ ) using the common key K _C '. [Equation 19]

In addition, the attacker calculates the common key K _c 'and the variable z _j ' represented by the following equations 20 and 21, respectively, encrypted in step 9 ID information ID ₁ using the common key K _C ' and the variable z _j 'and conveys a message (z _j ', E _{KC '} (ID ₁ )) to the conferees.

[Equation 20]

• K c '= w 1 r '  (mod p)

[Equation 21]

• z j '= n j r '  (mod p)

The participants in the conference conduct the protocol, mistaking the communication for a valid communication. This is because the common key K _C 'is calculated using the following equation 22, and the ID information ID _{1 is} obtained by decrypting E _KC' (ID ₁ ) using the common key K _C '. [Equation 22]

The reason that the session participating parties may not realize the hidden attack of the attacker is that the parties that receive the variable z _j, the joint conference key using only produce their own selected integer v _j, regardless of the selected integer v _{1 of} the Conference Calling Party. Accordingly, there is a need to improve the method of generating the variable z _j .

The continued secrecy is a certainty that when permanent secret key (long key) s _i (i = A, B, C) for more than a party that participates in the protocol reveals the attacker information to keys of past sessions using the revealed long-term key can not learn. If a persistent secret key is disclosed in a cryptographic system where continued secrecy is not guaranteed, all data in the past encryption session can be revealed, even in the case of the system being formed by creating a new secret key.

When Protocol Xu and Tilborg the secret value v _j, which is used for determining the common key of the equation 15 is used in Equation 11 as it is. In the case that the secret key s _{j of} the participant party j is revealed, the attacker, when receiving communications carried in the past session, can obtain the secret value v _j using the equation 11 with the known values of the parameters w _j , n _j and η _j and the former common key using Equation 15. As a result, the secrecy of the data encrypted in the previous sessions can not be guaranteed.

There is also a potential flaw in the Xu and Tilborg Protocol where the signature for authentication can be forged. When comparing equations 9 and 11 with the Schnorr signature generation method, the parameter η _j corresponds to a message and the parameters w _j and n correspond to signature values. In general, the signature value generation performed on the message at the time of writing the signature by applying a hash function is considered an indispensable procedure to avoid signature falsifications.

On the other hand, if the attacker knows the values of the parameters w _j , n _j and η _j , the parameters w _j ', n _j ' and η _j 'satisfying the equation 12 can be generated as shown in Equations 23 to 25 is shown. In this case, a potential weak point is that an attacker may be hiding, even though he can not share the key.

(Equation 23)

• w j '= (w j ) t  (mod p-1)

[Equation 24]

• n j '= n j  t w j

[Equation 25]

• η j '= η j  t w j

2 FIG. 10 is a flowchart illustrating steps of a conference session key distribution method according to the present invention. FIG. The parties involved in the key distribution process will be classified into a Conference Triggering Party A and Conference Participating Parties B, C, D .... In the Protocol, the Conference Triggering Party is sometimes called a Chairperson because the Conference Triggering Party appears to be chairing a conference.

In the ID-based cryptographic system, a conference session key-distribution protocol includes an ID-based cryptographic system implementation step and a common-key protocol step. The ID-based cryptographic system is constructed with a signature delivery system. If in the system a public key can be derived from personal ID information or previously provided, the public key transport may be skipped. On the other hand, in case the information of the public key is needed, as in the case where a signature needs to be authenticated, the public key is transported.

Now become the exemplary embodiments of the protocol for common keys, used in the ID-based cryptographic system proposed by Harn and Yang, described.

All parties participating in the session know public key parameters G, p, q, α, y and f. The parameter G, which is a subgroup of a group GF (P) *, is a finite group with a sufficiently large prime number p on the order of magnitude. The parameter q is a sufficiently large prime number and the associated integer q-1 has p as a factor. In the embodiment, an operation on the group G is represented by a multiplication. The group G has the parameter α as a basis. The parameter y is a public key from the KAC. The parameter f is a hash function. Each party i (i = A, B, C, ...) has a secret key s ₁ and a public key r _i provided by KAC.

At the Cryptographic system of urine and yang fulfill the ID information, the public key and the secret key the following equation 26.

[Equation 26]

• y si  = α f (IDi) (r i ri ) -1  mod q

The Steps of the shared key distribution method according to the present invention Invention are as follows.

Party A selects two random numbers u ₁ and v ₁ between the integers 1 and p-1. The two numbers u ₁ and v ₁ become temporary secret keys for the session. In a case where the operation time interval of the random function is longer than that of the hash function, a value determined by hashing the temporary secret key u _{1 may} be used as the temporary secret key v ₁ to decrease the operation time interval.

The temporary public keys w ₁ and n _{1 shown} in the following equations 27 and 28, respectively, are generated using the temporary secret keys u ₁ and v ₁ (S100). These are temporary public keys at the meeting.

[Equation 27]

• w 1 = y v1 (mod q)

[Equation 28]

• n 1  = w 1 u1  (mod q)

The signature value η ₁ represented by the following equation 29 is generated using the temporary secret keys, the temporary public key, a permanent secret key, the ID information ID _{1 of} the party A, and time information time (S110).

[Equation 29]

• η 1  = (f (n 1 , ID 1 , time) -v 1 w 1 ) s 1 -1 (mod p)

Party A generates a message (ID ₁ , r ₁ , w ₁ , n ₁ , η ₁ , time) 5 and transports the message 5 to the conference participants (S120).

The conference participant parties receive the message (ID ₁ , r ₁ , w ₁ , n ₁ , η ₁ , time) 5 and determine that the message 5 satisfies the following equation 30 (S200).

[Equation 30]

• y f (n1, ID1, time)  = w 1 w1  (a eid1 r 1 -r 1 ) η1  (mod q)

In Equation 30, EID ₁ = f (ID ₁ ).

If the message 5 sent by an eligible conference trigger party, it satisfies equation 30. If the message 5 sent by an invalid conference trigger party, it does not satisfy Equation 30. Therefore, the validity of the message sent by the party A can be completely determined using Equation 30. In the case where Equation 30 is satisfied, the protocol proceeds to the next step. Otherwise, the protocol is terminated (S210).

Each conference participant party randomly selects two integers _uj and _vj (j = B, C, D, ...) between the integers 1 and p-1. The two numbers become temporary secret keys of the corresponding conference participant party. In a case where the operation time interval of the random function is longer than that of the hash function, a value determined by hashing the temporary secret key u _{j may} be used as the temporary secret key v _j to decrease the operation time interval.

The temporary public keys w _j and n _{j shown} in the following equations 31 and 32, respectively, are calculated using the temporal The secret keys u _j and v _{j are} generated by each of the conference participant parties (S220). These temporary public keys become parameters that are used to create conference calls.

[Equation 31]

• w j = y vj (mod q)

[Equation 32]

• n j  = W 1 uj  (mod q)

The signature value η _j represented by the following equation 33 is obtained by using the temporary secret keys, the temporary public key, a permanent secret key, and the ID information ID _{j of} the party j (j = B, C, D, ...) in FIG Signature function generated (S230).

[Equation 33]

• η j  = (f (n j ) -v j w j ) s j -1 (mod p)

Each session participating party generates its own message (ID _j, r _j, w _j, n _j, η _j) 10 and transports the message 10 to the conference triggering party A (S240).

The conference trigger party A receives the messages 10 and determines that the messages 10 satisfy the following Equation 34 using the received variables (S300).

[Equation 34]

• y f (nj)  = w j wj  (a EIDj r j -RJ ) ηj  (mod q)

In Equation 34, EID _j = f (ID _j ).

If the message 10 sent by a legitimate conferees party, it complies with Equation 34. If the message 10 sent by an invalid conference party, it does not satisfy Equation 34. Therefore, the validity of the sharing sent by each conference party can be completely determined using Equation 34. If Equation 34 is satisfied, the protocol moves to the next step. Otherwise, the protocol is terminated (S310).

The conference initiation party A generates a common key K _c and a variable z _j which are used to generate the shared keys at the conference party parties shown in the following equations 35 and 36, respectively (S320). The conference initiation party A generates E _Kc (ID ₁ ) by encrypting its own ID information ID ₁ with the common key K _C (S330). Here, the symbol E denotes an encryption algorithm.

[Equation 35]

• K c  = n 1 u1  (mod q)

[Equation 36]

• z j  = (n 1 · n j ) u1  (mod q)

The conference trigger party A transports the message ( _zj , Ek _KC (ID ₁ )) 15 to the conference participant parties who receive the communications 10 which have been determined to be valid in step S310 (S340).

The conference participant parties that receive the messages 15 have received, calculate the common keys K _C , which are shown in the following equation 37 (S400).

[Equation 37]

• K c  = z j · (N 1 uj ) -1  (mod q)

The ID information is obtained by decrypting E _KC (ID ₁ ) with the common key K _{C obtained} from the equation 37 (S410), and it is determined that ID ₁ is identical to the ID information ID ₁ , those in the message 15 is obtained (S240). If the ID information of the conference release party A is identical, the encryption protocol is continued using the common key K _C. If not, the log is terminated.

Now become exemplary embodiments of the Protocol on the Common Use of Keys in accordance with the present Invention described in the ID-based cryptographic system under Use a Weil-pairing feature that works in an elliptic-curve encryption group is defined is used.

All parties participating in the meeting know public key parameters G, p, q, α, y, e, f ₁ , f ₂ and f ₃ . The parameter G is a finite group with a sufficiently large prime number p as order. The group G has the parameter α as a basis. The parameter y is a public key from the KAC. The parameter e is a Weil pairing function defined in an elliptic curve. The parameters f and f ₂ are hash functions defined in the field of integers. The parameter f ₃ is a hash function defined in the group G. In the embodiment, an operation on the group G is shown as an addition. The expression [x] y denotes a value of the x-fold addition of the element y of the group G.

Each party i (i = A, B, C, ...) has a secret key s _i and a public key r _i provided by the KAC. The public key r _i is a value derived from the ID information ID _{i of} each party i. The secret key s _i is calculated using the following equation 38.

[Equation 38]

• s i  = [s] · r i

Of the Value s in equation 38 is known only to the KAC and satisfies the the following equation 39.

[Equation 39]

• y = [s] α

steps the method for distributing a common conference key according to the present invention Invention are as follows.

Party A randomly selects two integers u ₁ and v ₁ between 1 and p-1. The two numbers u ₁ and v ₁ become temporary secret keys for the session. In a case where the operation time interval of the random function is longer than that of the hash function, a value determined by hashing the temporary secret key u _{1 may} be used as the temporary secret key v ₁ to decrease the operation time interval.

The temporary public keys w ₁ and n _{1 shown} in the following equations 40 and 41, respectively, are generated using the temporary secret keys u ₁ and v ₁ (S100).

[Equation 40]

• w 1  = [v 1 ] α

[Equation 41]

• n 1  = [u 1 ] w 1

The signature value η ₁ shown in the following equation 42 is generated by using the temporary secret keys, the temporary public key, a permanent secret key, the ID information ID _{1 of} the party A, and time information time (S110).

[Equation 42]

• η 1  = [v 1 -1 ] ([F 2 (f 3 (n 1 ) ID 1 , time)] α + [f 3 (w 1 )] S 1 )

Party A generates a message (ID ₁ , w ₁ , n ₁ , η ₁ , time) 5 and transports the message 5 to the conference participants (120).

The conference participant parties receive the message (ID ₁ , w ₁ , n ₁ , η ₁ , time) 5 and determine that the message 5 the following equation 43 satisfies (5200).

[Equation 43]

• e (w 1 , η 1 ) = e (α, [f 2 (f 3 (n 1 ), ID 1 , time)] α) · e (y, [f 3 (w 1 )] R 1 )

If the message 5 sent by an eligible conference party, it complies with Equation 43. If the message 5 is sent by an invalid conference trigger party, it does not satisfy equation 43. Therefore, the validity of the message sent from the party A can be completely determined using Equation 43. In case equation 43 is satisfied, the protocol proceeds to the next step. Otherwise, the protocol is terminated (S210).

Each conference participant party randomly selects two integers _uj and _vj (j = B, C, D, ...) between their 1 and p-1 as their temporary secret keys and generates their temporary public keys _wj and _nj , which are set forth in the following equations 44 and 45, respectively. The temporary public keys become parameters that are used to generate the conference key. In a case where the operation time interval of the random function is longer than that of the hash function, a value determined by hashing the temporary secret key u _{j may} be used as the temporary secret key v _j to decrease the operation time interval.

[Equation 44]

• w j  = [v j ] α

[Equation 45]

• n j  = [u j ] w 1

The signature value η _j shown in the following equation 46 is determined using the temporary secret keys, the temporary public key, a permanent secret key, and the ID information ID _{j of} the party j (j = B, C, D, ...) in FIG Signature function generated (S230).

[Equation 46]

• η j  = [v j -1 ] ([F 3 (n j )] α + [f 3 (w 1 )] S j )

Each session participating party generates its own message (ID _j, w _j, n _j, η _j) 10 and transports the message 10 to the conference triggering party A (S240).

The conference trigger party A receives the messages 10 and determines that the messages 10 satisfy the following equation 47 using the received variables (S300).

[Equation 47]

• e (w j , n j ) = e (α, [f 3 (n j )] α · e (y, [f 3 (w j )] R j )

If the message 10 sent by a legitimate conferees party, it satisfies equation 47. If the message 10 sent by an invalid conference party, it does not satisfy Equation 47. Therefore, the validity of the message sent from each conference party party can be completely determined using Equation 47. If Equation 47 is satisfied, the protocol moves to the next step. Otherwise, the protocol is terminated (S310).

The conference initiation party A generates a common key K _c and a variable z _j which are used to generate the shared keys at the conference party parties shown in the following equations 48 and 49, respectively (S320). The conference initiation party A generates E _Kc (ID ₁ ) by encrypting its own ID information ID ₁ with the common key K _c (S330). Here, the symbol E denotes an encryption algorithm.

[Equation 48]

• K c  = [u 1 ] n 1

[Equation 49]

• z j  = [u 1 ] (n 1  + n j )

The conference trigger party A transports the message ( _zj , E _KC (ID ₁ )) 15 to the conference participant parties who have sent the messages that have been determined to be valid in step S310 (S340).

The conference participant parties that receive the messages 15 receive, calculate the common keys K _C , which are shown in the following equation 50 (S400).

[Equation 50]

• K c  = z j  - [u j ] n 1

The ID information is obtained by decrypting E _KC (ID ₁ ) with the common key K _{C obtained} from the equation 50 (S410), and it is determined that ID ₁ is identical to the ID information ID ₁ , those in the message 5 is obtained (S240). If the ID information of the conference release party A is identical, the encryption protocol is continued using the common key K _C. If not, the log is terminated.

According to the exemplary embodiments of the method for distributing a common conference key of the present invention, it is possible to prevent a hidden attack by performing in steps 100 and 220 two different temporary secret keys are generated so that an attacker can not know the values of the two temporary secret keys, and the temporary secret keys of the conference initiation party are used at the time of generation of the conference key generation variable z _j . In addition, it is possible to ensure continued secrecy by preventing an attacker from calculating the previous shared keys even in a case where the attacker knows the permanent secret key of the parties participating in the session. In addition, it is possible to prevent an attacker from hiding without sharing keys by solving the potential weakness of the Xu and Tilborg Protocols. Since there is no increased computational effort, the protocol of the present invention is more effective than the conventional protocol.

The The present invention can be implemented with codes based on a computer readable storage medium are recorded. The computer includes all devices with data processing functions. The computer-readable storage medium includes all types of recording devices, which can be read by the computers. Examples of the computer readable equipment are ROMs, RAMs, CD-ROMs, magnetic tapes, floppy disks and optical Data recording devices.

While the present invention particularly with reference to exemplary embodiments shown and described, it is understood by those skilled in the art that different changes in Form and details can be made without the scope of the present As defined by the following claims is.

According to the shared key distribution method of the present invention, it is possible to provide an effective ID-based cryptographic system capable of preventing a hidden attack and ensuring continued secrecy by providing two different temporary secret keys a message is generated, and variables of the conference key generation are generated, with temporary Ge home key of a conference call party.

Claims (20)

A method of distributing a common conference key for encrypting a conference initiator party to a plurality of conference participant parties in a single conference session on an ID-based cryptographic system over a computer network, the method comprising the steps performed by the conference initiator party: (a) generating (s100) two temporary secret keys for the conference initiator party, generating two temporary public keys for the conference initiator party using the temporary secret keys for the conference initiator party and generating a signature value obtained by applying a predetermined signature function to the keys; (b) transporting a message (5) with ID information of the conference calling party, the temporary public key for the conference calling party and the signature value to the conference party parties; (c) receiving communications (10) with the temporary public keys for the conference party parties from the conference party parties and determining the validity of the messages; (d) generating shared key generation variables for the conference party parties that sent valid messages; (e) generating the common conference key (s320) using one of two temporary secret keys for the conference initiation party and the temporary public key for the conference initiation party generated using the one of two temporary secret keys and encrypting the ID information of the conference initiation party Using the common conference key; and (f) transporting a shared key generation variable message (15) and the encrypted ID information to the conferees that sent valid messages, wherein the ID based cryptographic system is a system having an equation y ^Si = a ^{f (IDi)} (r _i ^ri ) ^-1 mod q for a finite group G satisfies an order p, that is, a subgroup of GF (q) *, where q is a sufficiently large prime number and the associated integer q- 1 has the factor p, and wherein parameters y, a, f, r _i , s _i and ID _{i are} a public key of a key authentication center, a generation group of the finite group G, a hash function, a public key for a party i Designating secret keys for the party i and ID information, wherein the step (a) comprises the steps of: (a1) statistically selecting temporary secret keys u ₁ and v ₁ between 1 and p-1; (a2) generating temporary public key (s100) w ₁ = y ^v1 (mod q) and n ₁ = w ₁ ^u1 (mod q); and (a3) generating the signature value (s110) η ₁ = (f (n ₁ , ID ₁ , time) -v ₁ w ₁ ) s ₁ ^-1 (mod p), wherein the parameter ID ₁ and time ID information of the Designate conference trigger party and time information. A method for distributing a common conference key for encrypting from a conference call party to a plurality of conference party parties according to claim 1, wherein the step (a1) comprises the steps of: (a11) statistically selecting the first temporary secret key u ₁ between 1 and p-1; and (a12) generating the second temporary secret key v ₁ by applying the hash function to the first temporary secret key u ₁ . A method for distributing a common conference key for encrypting from a conference call party to a plurality of conference party parties according to claim 1 or 2, wherein step (c) comprises the steps of: (c1) receiving messages (ID _j , r _j , w _j , n _j , η _j ) (10) by the conference party parties, wherein parameters ID _j , r _j , w _j , n _j , and η _i ID information of the party j, a permanent public key of the party j, temporary public generated by the party j Key and a signature value generated by the party j; and (c2) determining (s300) that the messages received by the parties j satisfy an equation y ^{f (nj)} = w _j ^wj (a ^EIDj r _j ^-ri ) ^nj (mod q), wherein EID; = f (ID _j ). A method for distributing a common conference key for encrypting from a conference calling party to a plurality of conference party parties according to claim 3, wherein the step (d) is a step of generating the public key generation ^variable z _j = (n ₁ * n _j ) ^u1 (mod q ) for the conference participant parties that satisfy the equation in step (c2). A method for distributing a common conference key for encrypting from a conference call party to a plurality of conference party parties according to claim 3 or 4, wherein the step (e) comprises the steps of: (e1) generating the common conference ^key K _c = n ₁ ^u1 (mod q); (e2) encrypting the ID information of the conference calling party using the common conference key E _Kc (ID ₁ ), where E denotes an encryption algorithm. A method of distributing a common conference key for encrypting a conference call party to a plurality of conference party parties in a single conference session on an ID-based cryptographic system over a computer network, the method comprising the steps performed by the conference initiator party: (a) generating (s100) two temporary secret keys for the conference initiator party, generating two temporary public keys for the conference initiator party at Using the temporary secret keys for the conference initiation party and generating a signature value obtained by applying a predetermined signature function to the keys; (b) transporting a message (5) with ID information of the conference calling party, the temporary public key for the conference calling party and the signature value to the conference party parties; (c) receiving communications (10) with the temporary public keys for the conference party parties from the conference party parties and determining the validity of the messages; (d) generating shared key generation variables for the conference party parties that sent valid messages; (e) generating the common conference key (s320) using one of two temporary secret keys for the conference initiation party and the temporary public key for the conference initiation party generated using the one of two temporary secret keys and encrypting the ID information of the conference initiation party Using the common conference key; and (f) transporting a common key generation variable message (15) and the encrypted ID information to the conferees that sent valid messages, wherein the ID based cryptographic system is a system having a Weil pairing function in a finite elliptic curve encryption group G having a sufficiently large prime number p as the order, wherein step (a) comprises the steps of: (a1) statistically selecting temporary secret keys u ₁ and v ₁ between 1 and p-1; (a2) generating (s100) temporary public key w ₁ = [v ₁ ] a and n ₁ = [u ₁ ] w ₁ , wherein the parameter a is a generation source for the finite elliptic curve encryption group G; and (a3) generating the signature value (s110) n ₁ = [v ₁ ^-1 ] ([f ₂ (f ₃ (n ₁ ), ID ₁ , time)] a + [f ₃ (w ₁ )] s ₁ ) wherein f ₂ , f ₃ , ID ₁ , time and s _{1 are} a hash function defined in an integer domain, a hash function defined in the ellipse finite ellipse encryption group G, ID information of the conference trigger party, Designate time information and a permanent secret key of the conference call party. A method for distributing a common conference key for encrypting a conference calling party to a plurality of conference party parties according to claim 6, wherein the step (a1) comprises the steps of: (a11) statistically selecting the first temporary secret key u ₁ between 1 and p-1; and (a12) generating the second temporary secret key v ₁ by applying the hash function to the first temporary secret key u ₁ . A method for distributing a common conference key for encrypting from a conference call party to a plurality of conference party parties according to claim 6 or 7, wherein step (c) comprises the steps of: (c1) receiving messages (ID _j , w _j , n _j , η _j ) by the conference party parties, wherein parameters ID _j , w _j , n _j , and η _{j indicate} ID information of the party j, temporary public keys generated by the party j, and a signature value generated by the party j; and (c2) determining (s300) that the party j an equation e (w _{j, j} η) = e (a, [f ₃ (n _j)] a) · e (y, [f ₃ (w _j) ] _j ), where e, y and r _j denote a Weil pairing function defined on an elliptic curve, a public key of a key authentication center and a permanent public key of the conference party j. A method for distributing a common conference key for encrypting from a conference calling party to a plurality of conference party parties according to claim 8, wherein the step (d) is a step of generating the public key generation variable z _j = [u ₁ ] (n ₁ + n _j ) for the conference participant parties that satisfy the equation in step (c2). A method for distributing a common conference key for encrypting from a conference calling party to a plurality of conference party parties according to claim 8 or 9, wherein the step (e) comprises the steps of: (e1) generating the common conference key K _c = [u ₁ ] n ₁ ; and (e2) encrypting the ID information of the conference calling party using the common conference key to generate E _Kc (ID ₁ ), where E denotes an encryption algorithm. A method of distributing a common conference key for encrypting a conference initiator party to conference participant parties in a single conference session on an ID-based cryptographic system over a computer network, the method comprising the steps performed at the conferees parties: (a) receiving a message with ID -Information, two temporary public keys and a particular signature value of the conference trigger party from the conference trigger party and determining the validity of the message; (b) generating two temporary secret keys for the conferees parties, generating two temporary public keys for the conferees using the temporary secret keys for the conferees parties, and generating a signature value obtained by applying a particular signature function to the keys; (c) transporting a message containing the temporary public keys to the conference party parties and the signature value to the conference initiator party; (d) receiving a message having a common key generation variable and encrypted ID information of the conference initiating party from the conference initiating party; (e) generating the shared conference keys using the shared key generation variable, one of two conferee conference party secret keys, and the temporary public key for the conference initiation party generated using one of the two temporary secret keys; and (f) decrypting the encrypted ID information of the conference calling party using the common conference key and determining that the common conference key is valid, wherein the ID-based cryptographic system is a system ^having an equation y ^Si = a ^{f (IDi)} ( r _i) ^-1 mod satisfied in a finite group G having an order p, that is, a partial group of GF (q) *, wherein q is a sufficiently large prime number and the associated integer q-1 factor p has ^ri q and wherein parameters y, a, f, r _i , s _i, and ID _i denote a public key of a key authentication center, a finite group G generation source, a hash function, a public key for a party i, a secret key for the party i and ID information for the party i, wherein the step (b) comprises the steps of: (b1) statistically selecting temporary secret keys u _j and v _j between 1 and p-1; (b2) generating temporary public keys w _j = y ^vj (mod q) and n _j = w ₁ ^uj (mod q); and (b3) generating the signature value η _j = (f (n _j ) -v _j w ₁ ) s _j ^-1 (mod p). A method of distributing a common conference key for encrypting from a conference call party to conference party parties according to claim 11, wherein the step (b1) comprises the steps of: (b11) statistically selecting the first temporary secret key u _j between 1 and p-1; and (b12) generating the second temporary secret key v _j by applying the hash function to the first temporary secret key u _j . A method of distributing a common conference key for encrypting from a conference call party to conference party parties according to claim 11 or 12, wherein the step (a) comprises the steps of: (a1) receiving a message (ID ₁ , r ₁ , w ₁ , n ₁ , n ₁ , time) from the session initiating party, wherein parameters ID _1, r _1, w _1, n _1, n ₁ and time ID information of the session initiating party, a permanent public key of the session initiating party, generated by the session initiating party temporary public keys, one of the Calling party generated signature value and time information; and (a2) determining that the message an equation y ^{f (n1, ID1, time)} = w ₁ ^{w 1} (a ^eid1 r ₁ ^{-r 1) η1} (mod q), wherein EID ₁ = f satisfies (ID _1). A method of distributing a common conference key for encrypting from a conference call party to conference party members according to claim 13, wherein said step (e) is a step of generating a common conference key K _c = z _j * (n ₁ ^uj ) ^-1 (mod q) and where z _j denotes the generation key for the shared key received from the conference trigger party. A method of distributing a common conference key for encrypting a conference initiator party to conference participant parties in a single conference session on an ID-based cryptographic system over a computer network, the method comprising the steps performed at the conference participant parties: (a) receiving a message with ID Information, two temporary public keys, and a particular signature value of the conference initiation party from the conference initiation party and determining the validity of the message; (b) generating two temporary secret keys for the conferees parties, creating two temporary public keys for the conferees using the temporary secret keys for the conferees parties and generating a signature value obtained by applying a particular signature function to the keys; (c) transporting a message containing the temporary public keys to the conference party parties and the signature value to the conference initiator party; (d) receiving a message with a common key generation variable and encrypted ID information of the conference trigger Party from the Conference Triggering Party; (e) generating the shared conference keys using the shared key generation variable, one of two conferee conference party secret keys, and the temporary public key for the conference initiation party generated using one of the two temporary secret keys; and (f) decrypting the encrypted ID information of the conference calling party using the common conference key and determining that the shared conference key is valid, wherein the ID-based cryptographic system is a system that performs a Weil-pairing function in a finite elliptic curve. encryption group G used with a sufficiently large prime number p as an order, and wherein the step (b) comprises the steps of: (b1) randomly selecting temporary secret keys u ₁ and v ₁ between 1 and p-1; (b2) generating temporary public keys w _j = [v _j ] a and n _j = [u _j ] w ₁ , wherein the parameter a is a generation source for the finite elliptic curve encryption group G; and (b3) generating the signature value η _j = [v _j ^-1 ] ([(f ₃ (n _j )] a + [f ₃ (w _j )] s _j ) where f ₃ and s _{j are} a hash function , which is defined in the finite elliptic curve encryption group G, and a party's permanent secret key j. A method of distributing a common conference key for encrypting from a conference call party to conference party parties according to claim 15, wherein step (b1) comprises the steps of: (b11) statistically selecting the first temporary secret key u _j between 1 and p-1; and (b12) generating the second temporary secret key v _j by applying the hash function to the first temporary secret key u _j . A method of distributing a common conference key for encrypting from a conference call party to conference party members according to claim 15 or 16, wherein the step (a) comprises the steps of: (a1) receiving a message (ID ₁ , w ₁ , n ₁ , n ₁ , time ) from the conference calling party, wherein the parameters ID ₁ , w ₁ , n ₁ , n ₁ and time ID information of the conference calling party, temporary public keys generated by the conference calling party, a signature value generated by the conference calling party and time information; and (a2) determining that the message has an equation e (w ₁ , η ₁ ) = e (a, [f ₂ (f ₃ (n ₁ ), ID ₁ , time)] a) · e (y, [f ₃ (w ₁ )] r ₁ ), where e, f ₂ , f ₃ , y and r _{1 are} a Weil-pairing function defined on an elliptic curve, a hash function defined in an integer domain , a hash function defined in the finite elliptic curve encryption group G, a public key of a key authentication center, and a permanent public key of the conference trigger party. A method of distributing a common conference key for encrypting from a conference call party to conference party parties according to claim 17, wherein step (e) is a step of generating a common conference key K _c = z _j - [u _j ] n ₁ and wherein z _{j is} the generation variable for denotes the shared key received from the conference calling party. Method of distributing a common conference key to encode from a conference trigger party to conference participant parties according to one of claims 11 to 18, wherein step (f) comprises the steps of: (f1) decrypt the encrypted ID information of the conference trigger party, received by the conference participant party using the common conference key; and (f2) determining that the decrypted ID information of the conference initiation party identical to the ID information of the conference calling party, received in step (a). Computer-readable storage medium on which a program recorded, which is suitable for all steps of a procedure to carry out according to one of the preceding claims, if run it on a computer becomes.